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DETAILED ACTION 
Status of Claims 

Claims 54, 55, 57, 60-64 and 68-75 are currently pending in tlie instant 
application. Claims 1-53, 56, 58, 59, 65-67 and 76-97 have been cancelled. 

Response to Arguments 

1 . Applicant's arguments, see Applicant's Remarks, filed July 23, 2009, with respect 
to the rejection of claim 68, and claims 69-72 which depend therefrom, under 35 
U.S.C. §1 02(e) as being anticipated by U.S. Publication No. 2003/0187977 to Cranor, et 
al. ("Cranor") have been fully considered and are persuasive. Therefore, the rejection 
has been withdrawn. However, upon further consideration, a new ground(s) of rejection 
is made in view of U.S. Patent No. 7,016,951 to Longworth, et al. ("Longworth"). 

2. Applicant's arguments with respect to claim 73, and claims 74 and 75 which 
depend from claim 73, and to claim 54, and claims 55, 57 and 60-63 which depend 
from claim 54, and to claim 64, have been considered but are moot in view of the new 
ground(s) of rejection. 

Specification 

3. The disclosure is objected to because of the following informalities: in the list of 
drawings on page 13, Para [0055] of the new Specification, "Figure 17a and 17c" should 
read "Figure 17a to 17c" to include Figure 17b. 

Appropriate correction is required. 



Application/Control Number: 10/587,462 Page 3 

Art Unit: 2461 

Claim Objections 

1 . Claims 57, 60 and 62 are objected to because of the following informalities as 
noted below. 

As to claim 57, the claim recites that it depends from "the method as claimed in 
claim 56". Claim 56 has been cancelled. For purposes of examination, this claim has 
been interpreted to depend from claim 54. Appropriate correction is required by either 
amending the claim to depend from claim 54 or deleting the claim. 

As to claim 60, the claim recites that it depends from "the method as claimed in 
claim 58". Claim 58 has been cancelled. For purposes of examination, this claim has 
been interpreted to depend from claim 54. Appropriate correction is required by either 
amending the claim to depend from claim 54 or deleting the claim. 

As to claim 62, line 5-6, the claim recites "said one or more of said intermediate 
statistics" which appears to mean "said one or more intermediate statistics". If this is 
the case, please replace "said one or more of said intermediate statistics" with - - said 
one or more intermediate statistics - - . 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

3. Claims 68-73 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Longworth et al. (US Patent No. 7,016,951) (hereinafter Longworth). 
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As to claim 68, Longworth discloses: 

"inputting network data captured from a digital mobile phone network" (a realtime 
network data stream 144 is sensed and collected, and the observation port transmits a 
copy of the network data stream to interpreter module 108, Fig. 1, col. 3, lines 29-35; 
the network may be or include a GPRS, GSM, CDMA or TDMA link such as a cellular 
phone channel ("digital mobile phone network"), col. 2, lines 61-67); 

"said network data comprising data for a plurality of communications sessions 
over said network, said network data including a plurality of session related parameters" 
(the network data is captured and reassembled back into network sessions according to 
parameters" (assembler module 112 consolidates the arriving data packets 110 into 
complete session files TCP control protocol (TCP) sessions. Fig. 1-2, col. 3, lines 52- 
59; assembler module 112 transmits sessions 140 to parser module which uses 
application sensor 126 to analyze the information contained in and characterizing the 
session140; the information may include source and destination addresses and ports, 
sequence numbers and other parameters. Fig. 5; col. 4, lines 26-52); 

"dividing said captured network data into a plurality of data structures, one for 
each said communications session (once application type of session 140 has been 
determined, parser module 120 may store part or all of a complete session to content 
database 182, Fig. 1; col. 6, lines 30-34); 

"processing said divided data in accordance with one or more queries to 
generate statistical data for each of a plurality of said sessions, said query defining at 
least one statistic relating to one or more said parameters" (parsed session information 
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("divided data") is stored in the session database 122; the summary database 132 is 
generated by executing scripts or other query mechanisms against the session 
database, Figs. 2, 5 col. 7, lines 60-67; the inquiry includes query parameters that are 
analyzed by the presentation server 134); and 

"storing, in a data store, said statistical data for each of said sessions in 
association with a session identifier" (the summary database 1 32 is generated by 
executing scripts or queries against the session database ("statistical data"), col. 7, 
lines 60-67; results of interrogations on the session database are stored in summary 
database, col. 7, line 20-26; therefore, it is anticipated the results of an inquiry on a 
session in the session database will be stored in the summary database with a session 
identifier to be able to identify the of the target of the inquiry, or in other words, a query 
parameter); 

"whereby network data for a session used to generate said statistical data is 
retrievable" (presentation interface 138 allows a systems administrator to invoke 
different inquiries into the past behavior of network 142; inquiries may include an 
investigation of Websites most frequently visited by users of the network, users 
exhibiting the highest rate of e-mail traffic, etc. ("statistical data") col. 7, lines 11-19; 
Applicant's Substitute Specification, H 60, describes the ability to "drill down into 
individual data sessions" to determine which particular websites or sites are being 
accessed. Longworth explicitly discloses this element as described immediately 
above). 

As to claim 69, Longworth discloses all of claim 68. 
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Longworth further discloses "statistical data comprises statistical data 
aggregatable to provide said at least one statistic for a combination of two or more said 
sessions" (presentation interface allows a system administrator to invoke different 
inquiries into the past behavior of the network, including an investigation of Websites 
most frequently visited and other user characteristics; col. 7, lines 11-19, and the 
characterization module may store high-level digested data indicating overall behavior 
of the network, col. 7, lines 27-31; the inquiries are made on the data from the 
summary database which was built from the session database; col. 7, lines 20-26; and 
therefore it is anticipated the results of these queries ("statistical data") are based on 
more than one session as they indicate overall behavior of the network). 

As to claim 70, Longworth discloses all of claim 68. 

Longworth further discloses "operating on each said data structure to generate 
said statistical data" (execution of scripts through an OLAP or other relational database, 
e.g. SQL, generates the summary database from searches on the session database, 
col. 7, lines 7-10, 62-66). 

As to claim 71, Longworth discloses all of claim 68. 

Longworth further discloses "storing indexed by one or more of said parameters" 
(once a type of session 140 has been determined, parser module 120 may store part or 
all of a complete session to content database 182 after assignation of a unique storage 
address; parser module also processes the protocol for a given session and generates 
the minimum subset of information needed to identify the nature of the session for 
recording on session database. Fig. 1; col. 6, lines 30-48; then the user inputs the 
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query, the presentation server analyzes tine query parameters and communicates witli 
the summary database, col. 8, lines 1-9; it is anticipated that the query parameters are 
in a the format compatible with accessing stored session data in session database). 
As to claim 72, Longworth discloses all of claim 68. 

Longworth further discloses "processing is performed in parallel for said plurality 
of data structures"(system may be configured so that interpreter module 108 could 
accept samples of the network data stream from multiple ports ("in parallel"), col. 8, 
lines 10-16). 

As to claim 73, Longworth discloses: 

"means for inputting network data captured from a digital mobile phone network 
(a realtime network data stream 144 is sensed and collected, and the observation port 
transmits a copy of the network data stream to interpreter module 108, Fig. 1, col. 3, 
lines 29-35; the network may be or include a GPRS, GSM, CDMA or TDMA link such 
as a cellular phone channel ("digital mobile phone network"), col. 2, lines 61-67), 

"said network data comprising data for a plurality of communications sessions 
over said network, said network data including a plurality of session related parameters" 
(the network data is captured and reassembled back into network sessions according to 
parameters (assembler module 112 consolidates the arriving data packets 110 into 
complete session files TCP control protocol (TCP) sessions. Fig. 1-2, col. 3, lines 52- 
59; assembler module 112 transmits sessions 140 to parser module which uses 
application sensor 126 to analyze the information contained in and characterizing the 
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session140; the information may include source and destination addresses and ports, 
sequence numbers and other parameters. Fig. 5; col. 4, lines 26-52); 

"means for dividing said captured network data into a plurality of data structures, 
one for each said communications session" (once application type of session 140 has 
been determined, parser module 120 may store part or all of a complete session to 
content database 182, Fig. 1; col. 6, lines 30-34); 

"means for processing said divided data in accordance with one or more queries 
to generate statistical data for each of a plurality of said sessions, a said query defining 
at least one statistic relating to one or more of said parameters" (parsed session 
information ("divided data") is stored in the session database 122; the summary 
database 132 is generated by executing scripts or other query mechanisms against the 
session database. Figs. 2, 5 col. 7, lines 60-67; the inquiry includes query parameters 
that are analyzed by the presentation server 134); and 

"means for storing, in a data store, said statistical data for each of said sessions 
in association with a session identifier; whereby network data for a session used to 
generate said statistical data is retrievable" (the summary database 132 is generated by 
executing scripts or queries against the session database ("statistical data"), col. 7, 
lines 60-67; results of interrogations on the session database are stored in summary 
database, col. 7, line 20-26; therefore, it is anticipated the results of an inquiry on a 
session in the session database will be stored in the summary database with a session 
identifier to be able to identify the of the target of the inquiry, or in other words, a query 
parameter). 
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means for storing an identifier of said plurality of data structures (the summary 
database 132 is generated by executing scripts or queries against the session database 
("statistical data"), col. 7, lines 60-67; results of interrogations on the session database 
are stored in summary database, col. 7, line 20-26; therefore, it is anticipated the 
results of an inquiry on a session in the session database will be stored in the summary 
database with a session identifier to be able to identify the of the target of the inquiry, or 
in other words, a query parameter), 

whereby network data for a session used to generate said statistical data is 
retrievable with said data structures being accessible one at a time (once a type of 
session 140 has been determined, parser module 120 may store part or all of a 
complete session to content database 182 after assignation of a unique storage 
address ("storing an identifier"); parser module also processes the protocol for a given 
session and generates the minimum subset of information needed to identify the nature 
of the session for recording on session database. Fig. 1; col. 6, lines 30-48, and 
further, the Abstract describes that the parser module extracts only the minimum 
information needed to reconstruct individual sessions which indicates how the stored 
sessions are intended to be used and accessed ("data structures being accessible one 
at a time"); 

when statistical analysis indicates when session should be examined 
(presentation interface allows system administrator to invoke different inquiries into the 
past behavior of the network, including investigation of information recorded in the 
resulting databases, i.e. the summary and session databases; the variety of forensic 
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inquiries tliat may be formulated is a function of tine complete nature of the surveillance 
performed and the storage of the results of those interrogations in summary database 
("statistical analysis") (col. 7, lines 11-19) 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

5. Claims 54, 55, 57, 60-64, 74 and 75 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Cranor at al. (US PGPub 2003/0187977) (hereinafter Cranor) 
in view of Longworth et al. (US Patent No. 7,016,051) (hereinafter Longworth). 

As to claims 54 and 64, Cranor discloses a method of: 

"inputting network data captured from a digital mobile phone network" (data 

arriving In the network is placed in a buffer, Fig. 7, H 62, lines 3-5); 

"inputting query data for one or more queries, a query defining a statistic relating 

to one or more of said parameters, to be computed from said network data" (network 



Application/Control Number: 1 0/587,462 Page 1 1 

Art Unit: 2461 

monitor allowing network application-level queries to collect statistics, ^ 14, 38-40, Fig. 
2); 

"formatting a said query to define said statistic in terms of one or more 
intermediate statistics relating to said one or more parameters and to be computed from 
said network data, said statistic being computable from said one or more intermediate 
statistics" (an filtering, transformation, and aggregation (FTA) ("query") process may 
depend on the output of another FTA for input ("intermediate statistics"), H 36; 
additionally, queries for monitoring tasks involving collection of aggregate statistics of 
the packet by combining several other intermediate statistics and aggregating them, 1| 
36 40); 

"operating, after said organizing, with said formatted query on said captured 
network data to determine said one or more intermediate statistics" (an application 
subscribes to an FTA process to receive statistics collected on the data, H 30-36); and 

"storing one or more sets of said one or more intermediate statistics in a data 
store for analysis" (a clearinghouse database stores output from FTAs (queries) which 
may be used as input to other FTAs ("intermediate statistics, H 33-36). 

Cranor does not explicitly disclose the captured network data comprises "a 
plurality of communications sessions over said network, said network data including a 
plurality of session related parameters". 

Longworth teaches the network data is captured and reassembled back into 
network sessions according to parameters (assembler module 112 consolidates the 
arriving data packets 110 into complete session files TCP control protocol (TCP) 
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sessions, Fig. 1-2, col. 3, lines 52-59; assembler module 112 transmits sessions 140 to 
parser module which uses application sensor 126 to analyze the information contained 
in and characterizing the session140; the information may include source and 
destination addresses and ports, sequence numbers and other parameters, Fig. 5; col. 
4, lines 26-52). 

Further Cranor does not explicitly disclose: 

"organizing said captured network data by communication session by dividing 
said captured network data into a plurality of data structures, one for each said 
communication session"; and 

"storing an identifier of said plurality of data structures whereby said data 
structures are accessible one at a time when statistical analysis indicates which session 
should be examined". 

Longworth teaches organizing such that once application type of session 140 has 
been determined, parser module 120 may store part or all of a complete session ("one 
for each communication session") to content database 182 (Fig. 1; col. 6, lines 30-34); 
and parsed session information ("divided data") is stored in the session database 122. 
Longworth further discloses that a minimum subset of information needed to identify the 
session is extracted removing unnecessary data (col. 6, lines 35-40). In the case that 
not all of the session data is retained, for instance, due to storage constraints as noted 
in col. 6, line 49-55, a subset of the data will be stored in order to perform more fully 
featured post hoc traffic analysis. From the information stored, inquiries may include an 
investigation of Websites most frequently visited by users of the network, users 



Application/Control Number: 10/587,462 Page 13 

Art Unit: 2461 

exhibiting tine liigliest rate of e-mail traffic, etc. (col. 7, lines 11-19). Applicant's 
Substitute Specification 60) describes the ability to "drill down into individual data 
sessions" to determine which particular websites or sites are being accessed. 
Therefore, Longworth discloses access to the raw data for each session. 

Longworth further teaches storing such that the summary database 132 is 
generated by executing scripts or queries against the session database ("statistical 
data") (col. 7, lines 60-67). Results of interrogations on the session database are 
stored in summary database (col. 7, line 20-26); and therefore, it is anticipated the 
results of an inquiry on a session in the session database will be stored in the summary 
database with a session identifier to be able to identify the of the target of the inquiry, or 
in other words, a query parameter. 

Longworth and Cranor are analogous art in that they both pertain to capturing 
and analyzing network data. It would have been obvious to one skilled in the art at the 
time the invention was made to capture and store network data relating to 
communication sessions as taught in Longworth with the network monitoring method in 
Cranor being that it allows statistics to be gathered for separate communication 
sessions, and is not constrained to detecting limited types of data, which is a problem 
noted in the Abstract of Longworth. 

As to claim 55, Cranor in view of Longworth disclose all of claim 54. 

Cantor further discloses "storing comprises storing said one or more intermediate 
statistics relating to said one or more parameters indexed by said one or more 
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parameters" (a clearinghouse database stores output from FTAs (queries) wliich may 
be used as input to other FTAs ("intermediate statistics, H 33-36). 

As to claim 57, Cranor in view of Longworth discloses all of claim 54. 

Longworth further discloses "storing comprises storing said intermediate statistics 
indexed by an identifier of a said communications session" ((the reconstructed network 
sessions are stored and the backend interface can analyze the data for other purposes 
("intermediate statistics"), see Fig.1, Abstract; reconstructed network sessions are 
assembled according to parameters, such as, protocol type, source and destination 
addresses or ports, sequence number and other variables, all of which could be an 
identifier of the session, see Abstract; additionally, once type of session is determined, 
the session is stored in the database and assigned a unique storage address, col. 6, 
lines 30-34). 

As to claim 60, Cranor in view of Longworth discloses all of claim 54. 

Cranor further discloses "providing captured network data for a communications 
session to a data pipe configured to store a time-ordered series of sets of entries, one 
for each of said one or more parameters, and reading parameters at a time position on 
said data pipe for a said formatted query" low-level FTAs are performed as the data 
comes in and results are fed to higher level FTAs (K 15-17) and includes aggregating 
statistics based for time intervals (H 40); 

As to claim 61, Cranor in view of Longworth discloses all of claim 54. 

Cranor further discloses "a database, the method further comprising determining 
a configuration for said database using said inputted query data" (the FTA (query) 
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processes are started which create data schema that is registered with the 
clearinghouse database to create the database, H 32-36). 

As to claim 62, Cranor in view of Longworth discloses all of claim 54. 

Cranor further discloses "inputting selection data defining selected ones of said 
one or more parameters" (low level and high-level FTAs (queries) are performed; H 15- 
17); and 

"reading said one or more intermediate statistics for said related parameters; and 
determining at least one said statistic for said related parameters from said intermediate 
statistics" (low-level FTAs (queries) can be used as input to a high-level FTA (query), 
(Fig. 7,11 17,62). 

As to claim 63, Cranor in view of Longworth discloses all of claim 62. 

Longworth further discloses "selection data comprises marketing or customer 
service report data" (on the backend, a system administrator may make queries using a 
presentation interface regarding user activity, including, frequently visited websites, 
analysis of different network addresses and their most frequent communicants, col. 7, 
lines 11-19). 

As to claim 74, Longworth discloses all of claim 73 but does not explicitly teach 
the further limitations of claim 74. 

Cantor teaches "means for inputting query data defining said one or more 
queries" (network monitor allowing network application-level queries to collect statistics, 
1114, 38-40, Fig. 2); 
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"means for formatting a said query to define a said statistic in terms of one or 
more intermediate statistics relating to said one or more parameters and to be 
computed from said networl< data, said statistic being computable from one or more 
sets of said one or more intermediate statistics" (an filtering, transformation, and 
aggregation (FTA) ("query") process may depend on the output of another FTA for input 
("intermediate statistics"), H 36; additionally, queries for monitoring tasks involving 
collection of aggregate statistics of the packet by combining several other intermediate 
statistics and aggregating them, 36, 40); 

"means for operating with said formatted query on said captured network data to 
determine said one or more intermediate statistics" (network monitor allowing network 
application-level queries to collect statistics, H 14, 38-40, Fig. 2); and 

"means for stohng said intermediate statistics in said data store for analysis" (a 
clearinghouse database stores output from FTAs (queries) which may be used as input 
to other FTAs ("intermediate statistics"), H 33-36). 

Longworth and Cranor are analogous art in that they both pertain to capturing 
and analyzing network data. It would have been obvious to one skilled in the art at the 
time the invention was made to capture network data relating to communication 
sessions as taught in Longworth with the network monitoring method in Cranor being 
that it allows statistics to be gathered for separate communication sessions, and is not 
constrained to detecting limited types of data, as indicated in the abstract of Longworth. 

As to claim 75, Longworth discloses all of claim 73. 
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Longworth does not explicitly teach "a plurality of processors, each said data 
structure having an associated processor to perform said processing and to send said 
statistical data for a session over a network to said data store". 

Cranor discloses multiple FTAs processed separately on tuples (data structures) 
and the data is stored in the clearinghouse database. Fig. 1, H 27, 30-36). 

As previously discussed, Cranor and Longworth are analogous art. It would have 
been obvious to one skilled in the art at the time the invention was made to combine the 
processor structure in Cranor with the system in Longworth being that it allows higher 
throughput of the data monitoring and query processing. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MARIA L. SEKUL whose telephone number is (571)270- 
7636. The examiner can normally be reached on Monday - Friday 9:00-5:30 EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Huy Vu can be reached on (571 ) 272-31 55. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding tine status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Examiner 
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